Documentation
¶
Overview ¶
Package auth is Google Workspace sign-in and the instance claim that hangs off it.
It is not a transport. The local and tailnet listeners still name the caller the way they always have; this package adds a session cookie (Identify) and, when Google OAuth is configured, restricts humans on an unclaimed instance to WhoAmI and Claim. The local token and node identity stay fully privileged for the CLI and workers.
Index ¶
Constants ¶
const ( StatusPath = "/auth/status" StartPath = "/auth/google/start" CallbackPath = "/auth/google/callback" LogoutPath = "/auth/logout" // PicturePath is the signed-in user's Google avatar, proxied same-origin so // tracking protection cannot hide it. PicturePath = "/auth/picture" )
Paths the browser hits without a session. Mounted outside the identity middleware.
const CookieName = "podium_session"
CookieName is the session cookie set after a Google callback. HttpOnly, SameSite=Lax.
Variables ¶
This section is empty.
Functions ¶
func RestrictUnclaimed ¶
RestrictUnclaimed forbids KindUser from everything except WhoAmI and Claim until the instance has an owner, and afterwards requires the caller's domain to match. Nodes and the local token are not humans and are not gated — workers and the CLI still use them. A no-op when googleEnabled is false, so existing deployments do not change.
Types ¶
type Flow ¶
Flow holds in-flight OAuth states. Podium is a single process, so this lives in memory and a restart drops anything mid-login, which is the right answer.
type Google ¶
type Google struct {
ClientID string
ClientSecret string
// PublicURL, if set, is the origin used for the OAuth redirect URI. Empty means the
// start request's own origin, so a single client can have both localhost and a
// production URI registered.
PublicURL string
HTTPClient *http.Client
AuthURL string
TokenURL string
UserInfoURL string
}
Google is the OAuth client. Zero ClientID means Google sign-in is off and none of the /auth/google routes do anything useful.
type Handler ¶
Handler serves /auth/*. Status is always public. The Google routes 404 when OAuth is off.
func NewHandler ¶
NewHandler returns the /auth/* mux. flow may have Google disabled.
type Layer ¶
type Layer struct {
// contains filtered or unexported fields
}
Layer wraps a transport.Listener so a Google session cookie (or bearer) becomes KindUser before the inner transport is asked. Listen is delegated. Ready/BaseURL are NOT promoted: server.unwrapTransport looks through Inner() so the tailnet probes still hit the real listener.
Source Files